CVE-2026-44768

MediumCVSS 4.1

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The SAP CRM WebClient UI lacks a Content Security Policy (CSP) configuration for certain restrictive directives, allowing an attacker to inject and execute malicious scripts within the application context. This vulnerability has a low impact on integrity, while confidentiality and availability are not affected.

Risk Assessment

The organization is exposed to Cross-Site Scripting (XSS) attacks, which could lead to modification of displayed content, potentially affecting user trust and data integrity.

Recommendation

Configure appropriate Content Security Policy (CSP) directives in the WebClient UI to block untrusted script execution. It is also recommended to apply the latest security patches provided by SAP.

Other vulnerabilities in SAP CRM

CVE-2018-2380MediumActively exploited
SAP CRM, 7.01, 7.02, 7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

Original NVD description (English source)

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.